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Abstract 



Consider a time-slotted, single-hop, wireless sensor network (WSN) consisting of n correct devices 
and and t = f ■ n Byzantine devices where / > is any constant; that is, the Byzantine devices may 
outnumber the correct ones. There exists a trusted sender Alice who wishes to deliver a message m 
over a single channel to the correct devices. There also exists a malicious user Carol who controls the 
t Byzantine devices and uses them to disrupt the communication channel. For a constant k > 2, the 
correct and Byzantine devices each possess a meager energy budget of 0(n x / k ), Alice and Carol each 
CNJ ' possess a limited budget of 0(n 1 / fc ), and sending or listening in a slot incurs unit cost. This general setup 

. captures the inherent challenges of guaranteeing communication despite scarce resources and attacks on 

the network. Given this Alice versus Carol scenario, we ask: Is communication of m feasible and, if so, 
at what cost? 

We develop a protocol which, for an arbitrarily small constant e > 0, ensures that at least (1 — 
e) n correct devices receive m with high probability. Furthermore, if Carol's devices expend T energy 
jamming the channel, then Alice and the correct devices each spend only 0(T 1 /( fe+1 )). In other words, 
delaying the transmission of m forces a jammer to rapidly deplete its energy supply and, consequently, 
cease attacks on the network. 

m 

vo ! 1 Introduction 

■ Wireless sensors are continually shrinking, leading to increasingly dense networks built out of increasingly 
low-power devices. The concept of dense WSNs was popularized by the Smart Dust project [30] which 
CN provided the foundations for the well-known contemporary motes manufactured by Crossbow ifTTTl and Dust 

Networks lfl51 . While the size of commercially available units is on the order of a few cubic centimeters, 
more recent endeavors such as SPECKNET ll29l aim to reduce this to the cubic millimeter (mm) scale 0. 
With the drive toward smaller wireless devices, it is not difficult to fathom the future deployment of highly 
dense WSNs and, indeed, the difficulty of communicating in such networks has been examined by the 
rS ! research community |10[|171l32l . 

In this paper, we address the challenge of communicating in a dense WSN given an adversary Carol who 
engages in malicious interference of the wireless medium. Such jamming attacks have received significant 
attention in recent years given the ease of perpetrating such attacks and their effectiveness (see OTTl and 
references therein). Jamming constitutes a form of denial-of-service attack that is particularly devastating 
given that WSN devices, including proposed future architectures (21 EL are severely energy constrained. 
Therefore, the prospects for achieving communication seem dire given an attacker who controls a large 
number of network devices and coordinates their combined resources to jam. 

In this energy-starved setting, a sensible approach is to consider the rate at which a jamming adver- 
sary is required to expend energy relative to those devices attempting to overcome the jamming. If the 
adversary's total cost T is substantially higher, then preventing communication for any extended duration 
is prohibitively expensive and forces the adversary to quickly exhaust her energy supply. Here, a useful 
measure of cost is the number of slots during which a device is utilizing the channel. Specifically, sending 
and listening operations dominate the operating costs of the Telos mote — 35mW and 38mW, respectively, 
at OdBm — while sleeping incurs negligible cost on the order of fiW. A resource-competitive approach to 
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jamming -resistant communication was first explicitly studied in [23,24] where communication between two 
devices is guaranteed at an expected cost of O(T 62 ) per device. This result clearly places the adversary at 
a substantial disadvantage, but we ask: Is it possible to do better? 

To address this question, we consider a general network scenario involving (/ + l)n devices where / 
is any positive constant. Initially, a powerful adversary Carol corrupts t = f ■ n devices which may deviate 
from the protocol arbitrarily to launch attacks on the network; that is, these are Byzantine devices. We 
emphasize that, unlike traditional results addressing Byzantine fault tolerance, we do not require that the 
correct nodes are in the majority; instead, we allow t > n. 

Given this attack model, a trusted sender Alice attempts to propagate a message m to the remaining cor- 
rect devices. All devices, correct and Byzantine, have a severely constrained energy budget. We exploit the 
following insight: If a small tunable constant fraction of devices are allowed to terminate without receiving 
m, then significant improvements are possible. Given this, we derive the following main result: 

Theorem 1. Let k > 2. Assume Alice has an individual budget of 0(n l l k ln fc n) and aims to deliver a 
message to n correct nodes. Assume Carol is an adaptive adversary with an individual budget of 0(n l l k ) 
who controls f ■ n Byzantine nodes for any constant f > 0. Each node, correct and Byzantine, possesses a 
budget ofOin 1 ^). Then, for n sufficiently large, there is a protocol that guarantees the following properties 
with high probability: 

• If Carol and her Byzantine nodes jam for T slots, then Alice and the correct nodes each incur an 

i i 
individual cost of only 0(T fe +! + 1) and 0(T k + 1 + 1), respectively. 

• At least (1 — e) n correct nodes receive the message for any arbitrarily small constant e > and Alice 
and all correct nodes terminate within 0(n 1+ ^ 1 / fe ^) slots. 

where O denotes the existence of polylogarithmic terms. Additionally, if f < 1 /24, then these results hold 
when Carol is also a reactive adversary. 

This type of "almost-every where" communication plays an important role in several distributed comput- 
ing problems (see 1112111811221 and references therein). In many cases, it is sufficient to guarantee a majority 
of the processes receive critical information. For example, Alice and others may be attempting to implement 
Paxos 0, which relies on the notion of a majority quorum; therefore, m must reach a majority of the nodes. 
For any t < (1 — 8)n, for a constant 5 > 0, our protocol guarantees this property. In general, the ability to 
reach a (1 — effraction of the network is likely to be of importance in emerging WSNs. 

1.1 Our Network Model — Alice versus Carol 

We assume a single hop WSN with (/ + l)n devices where / > is a constant and where n is large; that 
is, the network is dense. Devices use a time division multiple access (TDMA)-like medium access control 
(MAC) protocol to access a single communication channel; that is, time is divided into discrete slots. This 
is a standard assumption — for example, the well-known LEACH [21] protocol is TDMA-based — but no 
global broadcast schedule is assumed. 

Nodes can detect whether a channel is in use via clear channel assessment ( CCA ) |f26l ; this is a common 
feature, for instance, it is available on the CC2420 transceiver lfT6l of the Telos mote and we also note that 
several theoretical models feature collision detection (see |[I]|4l[5j[20l[27]]). Jamming is indistinguishable 
from the case when two or more legitimate messages collide over the channel. Furthermore, jamming or a 
collision is only detectable on the receiving end of the wireless channel and, when this occurs, any received 
data is discarded. Finally, we assume that the absence of channel activity cannot be forged; in practice, such 
forging would be extremely difficult and, regardless, work in Q illustrates how this can be countered. 

Network Participants: There are (/+l)n correct nodes in the network of which t < f-n suffer a Byzantine 
fault and may deviate arbitrarily from any prescribed protocol. Each node is limited by a sublinear budget 
of at most C n 1//fc for any constant integer k > 2 and a sufficiently large constant C > 0. 
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Messages sent by Alice can be authenticated. For example, scalable dissemination of a small number 
of public keys is possible and we may assume that her public key (and, perhaps, only hers) is known to all 
receivers^ Therefore, attempts to tamper with m or spoof Alice can be detected. However, correct nodes 
may be spoofed which allows Carol to repeatedly request retransmissions of m from Alice. Our protocol 
must be resource competitive despite such a spoofing attack and we address this in Section 1272] 

Finally, as a trusted sender, Alice is invested in delivering information to the network; consequently, we 
expect her to bear more of the communication costs; however, given the scarce energy resources of WSNs, 
we still enforce a fairly strict budget on Alice. Specifically, her budget is at most C n 1//fc In n, the equivalent 
of only O(lnn) nodes; note that, for the puiposes of symmetry, we concede the same to Carol (see below). 

We do not assume that jamming has a uniform impact on the correct nodes. Any jamming by Carol or 
her Byzantine nodes can cause collisions and lost messages for some participants, while others receive the 
message correctly. More formally, a i-uniform adversary (see E71 ) is one who may partition the nodes into 
at most £ sets, each of which experience a different jamming schedule. We assume the worst-case, that Carol 
is an n-uniform adversary; therefore, she selects which nodes may detect jamming on an individual basis. 
Given the utility of collision detection, this capability yields a powerful advantage to Carol while abstracting 
many of the challenges to reliable wireless communication including hidden terminals and fading effects. 
Carol also possesses full information on how nodes have behaved (in terms of sending/listening) in the past 
and uses this knowledge to inform future attacks; that is, she adaptive. In this extended abstract, we assume 
that the actions of a node in the current slot are unknown to Carol; however, with modifications discussed 
in Section 14.11 our results hold when Carol possesses this information (ie. she is reactive). Finally, for 
the purposes of symmetry, we treat Carol as an additional Byzantine node with an individual budget of 
C n x l k In n to match that of Alice. 

Our Goal: Alice wishes to deliver m to as many correct nodes as possible while Carol, along with her 
Byzantine nodes, aims to prevent communication. Alice, Carol, correct nodes, and Byzantine nodes incur 
a unit cost of 1 for sending, listening, jamming, or altering messages. Our goal is to design a protocol 
that guarantees with high probability (w.h.p.) delivery of m to as many nodes as possible while ensuring 
the following two properties^ First, since all participants are energy starved, the protocol should be load 
balanced; that is, Alice and each correct node should incur asymptotically equal costs (up to logarithmic 
factors). Second, the costs incurred by Alice and each correct node should be asymptotically less than the 
total cost incurred by Carol and her nodes; that is, our protocol should be resource competitive. 
A Note on Resource Competitiveness: We are focusing on an individual correct node's cost compared to 
the aggregate cost incurred by Carol and her Byzantine nodes; call this a local perspective. But why not use 
a global perspective by using the aggregate cost of Alice and her correct nodes for comparison? 

There are several points in response. First, resource competitiveness from a local perspective is not a 
trivial task, especially given the strict resource constraints placed on nodes. Consider the naive approach 
where a correct node continually sends m until the jamming stops; this yields very poor resource com- 
petitiveness since each node spends at least as much as the adversary. Indeed, many (more sophisticated) 
algorithms for communication in WSNs suffer similarly. Second, guaranteeing resource competitiveness 
from a local perspective bounds the relative cost incurred by any single node; that is, the adversary cannot 
force any particular node to spend a disproportionate amount relative the adversary. In terms of maximizing 
a network's lifetime, it might be undesirable to achieve a global advantage if some nodes end up incurring 
substantially more relative cost. Therefore, a guarantee from a global perspective is not necessarily stronger. 
Third, for / > 1, our protocol achieves a constant-factor advantage from a global perspective. 

'Other authentication schemes can be assumed (9j- The important aspect is that this is a partially-authenticated Byzantine model 
since Alice is the only participant who can be authenticated. 

"We define "with high probability" to mean with probability at least 1 — n~ c for some constant c > we can tune. 
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1.2 Related Work 



There are a large number of results addressing general problems involving jamming attacks (see ED)- 
Closely related to our work are the results in ll23l which provide the first resource-competitive commu- 
nication protocol for two devices and also address a simple scenario with n devices. There are several 
differences between our current work and |23l . The latter provides Las Vegas protocols with expected costs 
and Carol's budget is completely unknown. For the 2-node and ra-node scenarios in j23l . the corresponding 
protocols are not load balanced since Alice spends roughly D - 62 while each correct receiving node spends 
D. Finally, 11231 can tolerate a reactive adversary only if external background communication traffic exists 
at no cost. In contrast, here we sacrifice a small number of nodes and focus on dense WSNs; however, our 
improved costs are guaranteed with w.h.p., our protocol is load-balanced, and the correct nodes themselves 
bear the costs for thwarting a reactive adversary. Our attack model differs in that we assume that both the 
correct and Byzantine nodes have roughly the same power. Specifically, Carol's collective budget is at most 
a constant-factor larger than the aggregate budget of the correct nodes and it is polynomially larger than any 
single correct node. 

Work by Ashraf et al. [3] investigates a similar line of reasoning employing multi-block payloads, so- 
called "look-alike packets" (which bears some resemblance to our strategy for dealing with reactive adver- 
saries in Section 14.11 ), and randomized wakeup times for receivers to force the adversary into expending 
more energy in order to effectively jam. Their approach is interesting but differs in many ways from our 
own and analytical results are not provided. 

There are a number of relevant analytical results on jamming. Gilbert et al. |[20l derive deterministic 
upper and lower bounds on the duration for which communication can be disrupted between two WSN 
devices where silence cannot be forged. Pelc and Peleg 11251 examine a random jamming adversary. Koo et 
al. examine the problem of multi-hop broadcast in a grid topology in the presence of jamming when 
the adversary's budget is exactly known. Awerbuch et al. give a jamming-resistant MAC protocol in a 
single-hop network with an adaptive, rate-limited bursty jammer. Richa et al ll27l significantly extended this 
work to multi-hop networks and, later, to reactive bursty adversaries |[28l . In models where mutiple channels 
are available, Dolev et al. fl2l address a (1 — e) gossiping problem, Gilbert et al. fl9l derive bounds on 
the time required for information exchange given a reactive adversary, and Dolev et al. |[T3ll address secure 
communication while tolerating a non-reactive adversary. 

In addition to pursuing a resource-competitive approach, our work differs from these related works in 
several ways. Our adversary is n-uniform; many previous results assume a 1-uniform adversary. Further- 
more, our adversary can be both adaptive and reactive, and she does not necessarily adhere to a particular 
jamming strategy (ie. bursty or random). Finally, our protocol does not rely on the availability of multiple 
channels; something that would likely not hold true given that Carol controls 0(ra) nodes and the number 
of channels is quite limited in practice. 

2 Our Algorithm 

Our communication algorithm e-BROADCAST is presented in Figured] For simplicity, we focus on the case 
for k = 2, but our proofs apply to general constant values of k. Recall we desire an algorithm that: (1) is 
load balanced and (2) is resource competitive. 

The constant e > determines the fraction of nodes that are guaranteed to receive m; we assume it is 
set prior to deployment. For our analysis, let e' > be an arbitrarily small constant (see Section I2T21 that 
we set and we will "renormalize" by e' to obtain e in the statement of our main result. A node u is said to be 
informed if u ever receives m; otherwise, u is said to uninformed. A slot that is either jammed or contains 
at least one transmission is called noisy; otherwise, it is called silent. e-BROADCAST proceeds in rounds 
indexed by i incrementing from 1 until communication is achieved. Each round consists of three phases: 
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e-Broadcast for round i when k = 2 

• Inform Phase - In each of 2^ a+b ^ % slots: 

o Alice sends m with probability 2 Iy , 
o Each uninformed node listens with probability 



Propagation Phase - In each of 2^ a+6 ^ slots: 

o Each informed node sends m with probability i and terminates at the end of the phase. 

o Each uninformed node listens with probability ^f+wsyr- 
Request Phase - In each of 2( b / 2+1 ) 1 slots: 

o Each uninformed node sends nack with probability i, listens with probability ^ 1 _ l ^el c ' ^ 1 anc ^ terrm ~ 
nates if at most 5c In n noisy slots are heard. 

o Alice listens with probability ( 1 _ e ^ 4 ';'" 2 " t , /2+1)i and terminates if at most 5c Inn nack messages or 
noisy slots are heard. 



Figure 1: Pseudocode for round i for e-BROADCAST when k = 2. 

Inform Phase: Consists of 2^ a+b ^ % slots. Alice send m with probability m each slot. Each node 
which has not yet received m listens to a slot with probability — 4 b 

Propagation Phase: Consists of 2^ a+b ^ slots. Each node u that received m in the preceding inform 
phase sends m with probability - and then terminates at the end of the phase. Each uninformed node 
listens in each slot with probability 4e(c + l)/2( a+ w 2 ))' for a sufficiently large constant c > 0. 

Request Phase: Consists of 2^2 +1 ) J slots. In each slot, each uninformed node u sends nack with 
probability 1/n and listens with probability — — C ^ E > oi ■ If at most 5c Inn noisy slots are heard (p 

(1— e ) 2 

cannot hear its own transmissions), then u terminates. Alice listens with probability 
in each slot and she terminates if the number of noisy slots heard is at most 5c In re. 



c In n 



(l- e -4E')2(( b / 2 )+ 1 ) i 



Discussion: Our protocol is parameterized by two constants a and b and these values dictate the costs to 
Alice and each node, respectively. In designing our protocol, we do not force values onto a and b; rather, 
these values are derived to achieve both load balancing and resource competitiveness. However, there are 
some self-evident bounds that we make explicit. Note that, in round i = lg n, Alice's maximum expected 
cost is 0(n a ) which implies that a < 1/2 given the allowed budget. Similarly, each node's cost is 0{n h / 2 ) 
which implies that b < 1. 

We assume that the constant C used in the budgets for Alice, Carol, and the nodes is large enough to 
subsume the constants in our protocol; see the details in Section 1231 Lemma [T2l Finally, we note that 
there are two advantages of choosing to send/listen in each slot independently and uniformly at random. 
First, our analysis is primarily concerned with i = f2(log log n); therefore, the expected costs for both Alice 
and each node are Q (log re) which means that these costs can be bounded to within a constant factor of 
their expectation via standard Chernoff bounds. Therefore, our protocol's costs are guaranteed with high 
probability. Second, information of how Alice and each correct node has behaved in the past conveys no 
information about their actions in the current slot. Therefore, our protocol does not yield any advantage to 
an adaptive adversary. 

2.1 Analysis of Our Protocol 

For the inform phase, let X u = 1 if node u receives m, otherwise let X u = 0, and let X v = 1 if node v 
receives m, otherwise let X v = 0. Note that X u and X v are dependent variables. For example, if X u = 
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because Alice never sent m or she was blocked, then it is more likely that X v = 0. Similarly, if X u = 1, 
then it is more likely that X v = 1. The following concentration result from lfl4ll is useful: 

Theorem 2. ( H14\l ) Let X\ , . . . , X^ be random variables. Let f be a function such that for each i £ {1, ...,£} 
there is a Ci > such that \ E[ f \ X\, ...,Xi] — E[ f \X±, | < Cj. Then: 



Pr{f > E[X] + A) < e 2S f=i c " 



Pr(f < E[X] - A) < e ^ 

Theorem |2] applies to dependent variables. Using this result, we show that, if Carol does not perform too 
much jamming, then w.h.p. there exists a set containing at least 6( ^ h 1 ° 2 " ) informed nodes by the end of the 
inform phase. We define an inform phase as blocked if more than half of the slots in this phase are jammed; 
otherwise, the phase is unblocked. In a blocked inform phase, Carol decides which nodes, if any, receive m 
since she is n-uniform. We also make use of the following identity: 

Lemma 1. 1 — y > e~ 2y for any y < 1/2. 

Throughout our analysis, we are concerned with 3 lg In n < i < lg n + O(l) as these allow us to derive 
concentration results; furthermore, as will see, the upper bound is a natural limit on the length of time our 
algorithm runs. Throughout our analysis, when we speak of informed/uninformed nodes, this implicitly 
applies only to correct nodes. 

Lemma 2. Assume at least e' n nodes are uninformed at the start of an unblocked inform phase and 
31glnn < i < lgn + 0(1). Then, w.h.p., the number of nodes that become newly informed by the end 
of this inform phase is at least — ^/.^f™ for an arbitrarily small constant A > and for n sufficiently large. 

Proof. Let s = 2 t - a+b ' >l . Define a binary random variable such that X u = 1 if node u obtains m in the 
inform phase; otherwise, let X u = 0. Let qj = 1 if Carol does not jam in slot j and let qj = otherwise. 
Then Pr(X u = 1) = 1 — Pr(u fails in inform phase) = 1 — J|* =1 (l — Pr(u succeeds in slot j)) = 

„, „ 4 In n y^s 2 In n 

1 " n;=i(l - ^T^m ■ <U) > 1 - e e ' 2( ° +(3/2,i,)l J=1 3 > 1 - e given that £ s j=1 q 3 > s/2 

since the inform phase is not blocked. Let y = -7^7557. By Lemma [U it follows that 1 — y = 1 — ^ 2 1 ° 6 " 2) . > 

e -2inn/,2( / ^ since y < 1/2. Therefore, we conclude that Pr(X u = 1) > 1 - e > ^ 2)i . Now 

let / = E«=i Xu where 1 > s > e '; that is > there 

are 8n > e' n uninformed nodes still active. By linearity 
of expectation, the expected number of nodes that receive m in the inform phase is E[f] > ^ffi 2 " . To prove 
a concentration result with dependent variables, we note that | E[ f \ X\, X u ] — E[f\X\, X u ~\ ] \ < 

\ 2 2 , 2 9 9 

(l—\)n\nn\ n ,- - ln n 

c u = 1 and use Theorem |2J It follows that Pr(f < K 2 W2)t — ) < e 2bi 2n = e 2 since i < lgn 
and where A > is an arbitrarily small constant. For sufficiently large n, this implies the desired upper 
bound result. □ 

Lemma [2] reveals the importance of Alice's 0(2 m Inn) budget as it facilitates a sufficiently large Si. The 
upper bound is similar: 

Lemma 3. Assume at least e 1 n nodes are uninformed at the start of an unblocked inform phase and 
31gln?i < i < lgn + 0(1). Then, w.h.p., the number of nodes that become newly informed by the end 
of this inform phase is at most — ^j^r- — for a constant A' > depending only on e 1 and for n sufficiently 
large. 
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Proof. We make an argument similar to that used in Lemma [2 Again, defining X u the same way, we have 
Pr(X u = 1) = 1 - n - =1 (1 - e , 2( ffi 3 /W ■ Qj) and note that TWWimi ^ V2 for the range of i and 
sufficiently large n. Therefore, Pr(X u = 1) = 1 - ]% =1 (1 ~ T^wkw ' 9j) ^ 1 ~ e"^ 7 ^ 1 using the 

fact that J2j=i Qj > s/2 and Lemma[U Then Pr(X u = 1) < 1 - e" < J^p 2)l where the inequality 

follows from the standard 1 — x < e~ x . Therefore, the expected number of newly informed nodes is less 
than f^^/2)i an< i> again using Theorem 12 where A > is a constant depending only on e', the probability 

that we have more than ^ 1+ ^ ( ^ 4 2 " lnn is superpolynomially small in n. For n sufficiently large, this yields the 
desired lower bound. □ 

Therefore, so long as at least e' n nodes are uninformed, we can generate a set S% of at least Q( 2 " 6 1 y 2 " ) newly 
informed nodes for 3 lg Inn < i < Ign + O(l); note, the size of this set is always sublinear in n (this 
is important to Lemma [H see below). Moreover, the size of this set is decreasing as i increases. This is 
due to the increasing length of the rounds and the limited energy afforded to each node. In the propagation 
phase of round i, we use the newly informed nodes in Si to send m to the remaining uninformed nodes. A 
propagation phase is blocked if more than half of the slots are jammed; otherwise, the phase is unblocked. 
Again, in a blocked propagation phase, Carol can decide which nodes receive m since she is n-uniform. 

Lemma 4. Consider (3/6) lg In n < i < lg n + 0(1) and assume that the inform phase in round i was not 
blocked. Then, if the propagation phase in round i is not blocked, w.h.p. all nodes are informed by the end 
of the propagation phase. 

Proof. Let s = 2^ a+b ' )l be the number of slots and let x be the number of newly informed nodes from the 
inform phase. Since the inform phase was not blocked, Lemmas |2] and [3] guarantee w.h.p. that ^"^/"j^"" < 
x ^ ^ 1+ 2 ol/2) i lnn f° r some arbitrarily small constant A > . In a single slot, the probability that ex- 
actly one informed node in Si is sending is lower bounded by x(^) (1 — ^) x_1 > ^^i^'' ' (1 — 

lN((l+A)4nlnn/2( i '/ 2 )')-l > (l-A)lnn -8(1+A) lnn/^/ 2 ^) > (1-8) Inn bin where the Second in- 

n> — 2( ft / 2 ) i — e-2( b / 2 ) i — e-2( i> / 2 ) i + 1 wllclc lnc » ct - u n u m 

equality follows by applying Lemma[U the second follows by noting that 2^ fe / 2 ^ > In n for i = (3/6) lg In n 
(later we show 6 = 1, thus keeping i within proper range), and the third follows from setting A = 1/2. Note 
that the sublinear upper bound on the size of Si prevents the probability of exactly one node sending from 
being too small. Therefore, the probability a particular uninformed node does not receive m in a single slot 
is at most 1 — - 2( i/^ + i ^C^mi % where qj = if Carol jams and qj = if she does not. The probability 
of a specific active and uninformed node failing to obtain m in this phase is at most Ylj=i 0- ~ 2 ^a+by l n Qj) 

2(e+l) Inn -™ 

< e 2 (a+b)i <?j ^ n -(c+i) s j nce qj > |. A union bound over all nodes yields the result. □ 

Note that any communication from Si aimed at telling Alice the inform phase was successful could be 
spoofed by Carol. Therefore, Si cannot ever replace Alice (allowing her to sleep) since it is impossible 
to verify that Si was created until the protocol terminates. Furthermore, keeping Si around for use in the 
propagation phase of round i + 1 is wasteful. In the context of our above analysis, the probability of a single 
node in Si U Si + i sending m increases, but this increase is not required since Si+i alone is sufficient^ 
Therefore, Si terminates at the end of every propagation phase. 

2.2 Request Phase: Tolerating Spoofing 

A request phase in round i is said to be blocked if Carol jams more than (1 — e _4e ')2( 6//2+1 ^ = Q J (2^ b / 2+1 ^ % ) 
slots during the phase0 We state two important properties of Alice's termination condition: 

'increasing the sending probability of each node in Si is also wasteful and causes nodes to exceed their budget in later rounds. 
4 Any constant fraction of the request phase will work; however, we choose this threshold to simplify the analysis. 
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Lemma 5. Assume that the request phase is unblocked. If at most 2e'n nodes remain active, where then 
w.h.p. Alice (correctly) terminates the protocol for e' < 1/2. 

Proof. Let s = 2( fc / 2+1 )\ The probability that no uninformed node sends a nack in a particular slot is 
(1 — ^) 2en . By Lemma [Q we have (1 — y l ) 2en > e _4e ; therefore, the probability that a slot is noisy is 
1 — (1 — \) 2e ' n < 1 — e _4e '. Let Yj = 1 if slot j is noisy due to a nack message by an uninformed node; 
otherwise, let Yj = 0. The expected number of noisy slots heard by Alice due to uninformed nodes is at 
most E[^2l Yj] < e _4 C J" 2 7b/ 2 +i)i ' (1 ~~ e _4e ) = clnn. Pessimistically, assume that each of Carol's 

blocked slots occurs when none of the other uninformed nodes are sending a nack message. Let Zj = 1 
if slot j is noisy due to Carol jamming; otherwise, let Zj = 0. The expected number of jammed slots is at 
most Zj] < (1 , e -4 C e '" 2 " i ,/2+i)» ■ (! - e-^')2^ 2+1 ^ = clnn. Therefore, the total expected number 

of noisy slots that Alice hears is at most 2c Inn. By standard Chernoff bounds, the probability of exceeding 
5c Inn is at most l/n c . □ 

Lemma 6. Assume at least 32e'n nodes are active at the beginning of a request phase where e' < 1/32. 
Then, w.h.p., Alice (correctly) does not terminate. 

Proof. The bad event occurs if the number of noisy slots that Alice detects is less than 5c Inn. Since Carol 
cannot forge silence, we do not consider her behavior here. The probability of a noisy slot is 1 — (1 — 
I)32e'n > 1 _ e ~32e> _ Therefore) as in the proof of Lemma[5l E[Y] > TTZ^TT ' (1 — e~ 32e ') > 10c Inn 

(1 e ) 

for s = 2( 6 / 2+1 ) i and any e' < 1/32. The result follows by standard Chernoff bounds. □ 
We prove a similar result for uninformed nodes: 

Lemma 7. Assume that the request phase is unblocked. If at most 32e'n nodes are active, where e' < 1/64, 
then w.h.p. every node terminates by the end of the request phase. 

Lemma 8. Assume at least 1024e'n nodes are active at the beginning of a request phase where e 1 < 1/1024. 
The, w.h.p., none of the uninformed nodes terminate in that request phase. 

To summarize the implications of these results, there are two bad situations: (1) if Alice or correct nodes 
can be tricked into perpetually executing the protocol at little cost to Carol, and (2) if Carol can cause Alice 
and all nodes to terminate with a large fraction of uninformed nodes. The values for the number of active 
(uninformed) nodes above are set such that neither bad case can happen. That is, to keep Alice or nodes 
executing the protocol past their termination condition, or to force a large number of nodes to terminate 
without to, would require Carol to jam £7(2^ fo / 2+1 ^ ) slots. 



2.3 Correctness & Resource Competitiveness 

The remainder of our analysis proceeds as follows. First, we show that if no blocked phases occur, then 
at least (1 — e')n nodes receive to. Second, when blocking phases do occur, we provide results on re- 
source competitiveness. Finally, we prove that eventually a round is encountered where blocking must stop; 
consequently, at least (1 — e')n nodes become informed. 

Lemma 9. Assume that there are no blocked phases in some round i > 3 lg In n and at least e'n nodes 
are alive at the beginning of this round for any e' > 0. Then, w.h.p., all correct nodes are informed and 
terminate. 

Proof. Since the inform phase of round i is not blocked, Lemmas [2] and [3] guarantee w.h.p. the creation 
of S{. Since the propagation phase is not blocked, Lemma [4] guarantees w.h.p. that all remaining active 
nodes receive m. Then, since the request phase is not blocked, Lemmas [5] and [6] guarantee w.h.p. that Alice 
terminates and Lemmas [7J and [8] guarantee that all nodes terminate. □ 
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Lemma [9] proves correctness in the absence of blocked phases; however, it is not yet apparent how the 
protocol may result in an small fraction of terminated, but uninformed, nodes. The critical observation is 
that we require e'n active uninformed nodes at the beginning of the inform phase in order for Lemma [9] to 
hold. Note that every Si set of informed nodes terminates and decreases the number of active uninformed 
nodes; however, since we can set e', this process does not prevent the existence of e'n active uninformed 
nodes at the beginning of each inform phase. 

Instead, note that by blocking a propagation phase, an n-uniform Carol may allow 2e'n nodes to remain 
uninformed and alive. By Lemma [5] and |7J Alice and all nodes terminate. Or Carol might block a propagate 
phase and let all but 32e'n nodes become informed; in this case, all nodes terminate with 32e'n uninformed. 
Critically, when Carol blocks an inform or propagate phase, she decides how many nodes receive m since 
she is a n-uniform adversary; this illustrates the challenges posed by a n-uniform adversary. We now analyze 
resource competitiveness and begin by stating the costs when no blocked phases ever occur: 

Lemma 10. Assume there are never any blocked phases. Then the cost to Alice is 0(log 3cl+1 n) and the 
cost to each node is 0{\og^^ 2 ^ b n). 

Proof. Given no blocked phases, Lemma|9]guarantees w.h.p. that all nodes become informed and terminate 
by round i = 3 lg In n and, given that round length increases geometrically with i, the costs in this round 
dominate those in earlier rounds. In the inform phase, Alice's cost is 0(log 3a+1 n) and each node's cost is 
<3(log( 3 / 2 ) fe n y in the propagation phase Alice is inactive while each node in S± incurs a cost of O(l), and 
each uninformed node incurs a cost of 0(log^ 3 ^ 2 ^ n). In the request phase, Alice's cost is O(logn) and 
each node's cost is 0(log^ 3 ^ 2 ^ n). Summing the costs yields the claim. □ 

Lemma 11. Assume that Carol spends T over the execution of e-BROADCAST and at least one phase is 
blocked. Then, w.h.p the cost to Alice is max{6{T a ^ a+b ^), d(T a ^ b / 2+1 ^)} and the cost to any node is 
max{0(T 1 /2(«»+6)),0(r( 6 /2)/(6/2+i))} > 

Proof. We analyze Alice and correct nodes separately: 

Cost for Alice: There are two strategies by which Carol can prevent Alice from terminating. The first 
strategy is where Carol blocks during at least one of the inform or propagation phases in each round. In 
this case, let r be the first round where both the inform phase and propagation phase are not blocked. Then 
the cost to Carol is T = £l(2( a+b ^ r ). Here, the cost to Alice is dominated by the cost of the next (and last) 
round since cost increases geometrically; this cost is 0(2 ar Inn) = O (T a /( a+b ) Inn). The second strategy 
occurs when Carol blocks the request phase in order to trick Alice into believing that at least 32e'n nodes 
remain uninformed. Let r' > r be the first round where Carol does not block the request phase. Note that 
r' > r since it does Carol no good to block the request phase if the inform or propagate phases were already 
blocked in the round. Then, Carol's cost is 0(2( 6//2+1 ) r ') while the cost to Alice is 0(T b / 2 + 1 Inn) since she 
will proceed into the next (and final) round. 

Cost for a Node: There are two strategies by which Carol can prevent a node from terminating. The first 
strategy is where Carol blocks at least one of the inform or propagation phases in each round. Let r be the 
first round where this does not occur. Then, the cost to Carol is T = 0,[2^ a+b ^ r ) while the cost to each 
node is 0{T b /^ a+b ^). The second strategy occurs when Carol blocks the request phase in order to trick 
the informed nodes into believing that at least 1024e'n nodes remain uninformed. Let r' > r be the first 
round where Carol does not block the request phase. Carol's cost is f2(2( fe//2+1 ) r ) while the cost to a node 
is 0(T( 6 / 2 )/( 6 / 2+1 ) ) since the node will proceed into the next (and final) round. □ 

Lemma [8] guarantees that, w.h.p., we can lose at most 1024e'n — 1 nodes. Therefore, we e = 1024e' 
(remembering that e' > can be an arbitrarily small constant) and state our final result for k = 2: 

Lemma 12. Assume a sender Alice with a budget of at most C n 1 / 2 In n who aims to deliver a message 
m to n correct nodes. Assume an adaptive adversary Carol with an individual budget of C n 1//2 Inn who 
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controls an additional n Byzantine nodes. Each correct and Byzantine node possesses a budget ofCn 1 ^ 2 . 
Then, w.h.p., e-BROADCAST guarantees the following properties: 

• If Carol and her Byzantine nodes jam for T slots, then Alice and each correct node terminates with 
an individual cost ofO{Ts + 1). 

• At least (1 — e)n correct correct nodes receive m for an arbitrarily small constant e > within 
0(n 3 / 2 ) slots. 

Proof. The worst-case resource-competitive ratios for Alice and the nodes should be equal. Lemma [TT] 
tells us that the exponents of interest for Alice are a/ (a + 6) and a/(b/2 + 1). Similarly, in the case of 
each node, the exponents of interest are b/(2(a + b)) and (6/2) (6/2 + 1). Therefore, depending on which 
terms are largest, we should solve for a and 6 in: a/ (a + 6) = 6/(2(a + 6)), a/ '(a + 6) = 6/2/(6/2 + 1), 
6/(2(a + 6)) = a/(6/2 + 1), or a/(6/2 + 1) = (6/2)/(6/2 + 1). While any two equations constrain the 
values of a and 6, there is actually a unique relationship between a and 6 that satisfies all four equations, 
namely a = 6/2. Given that 6 < 1, the best resource competitiveness is achieved for 6=1 yielding a cost 
to Alice of 0(T 1 / 3 In n + In 5 / 2 n) and a cost to each node of ©(T 1 / 3 + ln 5//2 n) where the second cost term 
in each cost function follows from Lemma [TOl 

We now prove that the budgets of Alice and each node are sufficient to guarantee the claimed properties. 
When executing e-BROADCAST, there exists some constant d > such that the cost to each node in round i 
is at most d 2^/ 2 )' = d 2 1 / 2 ; note that d depends on e, c, and k. Recall that a blocked send, propagation, and 
request phase are defined slightly differently in terms of the constant fraction of slots jammed. Therefore, 
to simplify the analysis, redefine any blocked phase in round i as one where more than p 2^/ 2 ^ slots are 
jammed for < /3 < 1. While we are redefining a blocked phase, any positive constant in the range (0,1) 
will yield the same resource competitive result asymptotically. 

Since each of the t Byzantine nodes has a budget of C n 1//2 , Carol and her Byzantine nodes possess a 
combined budget of C f v?l 2 + Cn 1 / 2 Inn < C (/ + 1) n 3 / 2 . Therefore, using this budget, Carol cannot 
block a send, propagation, or request phase consisting of (C//3)(/ + l)n 3 / 2 slots or more. Solving for 
2 (3/2)i _ (cy^ + n 3/2 implies t hi s occurs in round i = lgn + § lg((C//3)(/ + 1)). 

The cost to each correct node for executing e-BROADCAST in this round i = lg n + 1 lg(2(C//3)(/ + 1)) 
is at most d2 1 / 2 = d((C//3)(f + l)) 1//3 n 1//2 . We must take into account previous rounds, but given the 
geometric increase in cost per round, the total cost up to this round is at most 2d ((C//3)(f + l)) 1 / 3 n 1 / 2 . 
Therefore, so long as C > (3d) 3 / 2 • ((/ + l)//?) 1 / 2 , w.h.p. a correct node does not exceed its budget. By 
an almost identical argument, w.h.p., Alice does not exceed her budget of Ch^Im. Therefore, for C 
sufficiently large, Alice and the correct nodes are guaranteed to reach a round where there are no blocked 
phases and, therefore, Lemma [9] guarantees that at least (1 — e)n nodes are informed and terminate; the e- 
fraction that might terminate without m follows from our observations about an n-uniform adversary. Given 
the doubling of the number of slots in each round, this last phase occurs within 0(n 3 / 2 ) slots. □ 

Discussion: In designing e-BROADCAST, the inform and propagation phases are very similar and their 
length was left to be derived later. However, setting 2^/ 2+1 ) ? slots for the request phase may seem arbitrary. 
To see that this is not the case, consider the request phase length as a function of a and 6, /(a, 6), which 
yields relative costs in the request phase for Alice and each node of 0(T a/ '/( a > 6 )) and d(T( b / 2 )/ f( a ' b )), 
respectively. Note that setting f(a,b) > 6/2 + 1 decreases the relative cost for Alice and each node in 
the request phase. This makes the respective relative costs in the inform/propagate phases, a/ (a + 6) and 
b/(2(a + 6)), dominant and yields no improvement in the overall resource competitiveness. Conversely, 
if f(a, b) < 6/2 + 1, then this increases both d{T a ^ ( - a ^) and 0(T( fe / 2 V f( a > b )) and a different resource- 
competitive result can be obtained; however, this would not yield a load-balanced solution. Therefore, 
/(a, 6) = 6/2 + 1 is the maximum length that can be used for the request phase that gives the best resource- 
competitiveness while enforcing a load-balanced protocol. 
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e-Broadcast for round i 

• Inform Phase - In each of 2^ 1+ "^^ slots: 

o Alice sends m with probability 2c '"^ - . 

o Each uninformed node listens with probability 

• Propagation Phase - For step h — 1 to k — 1 execute: 

o In each of 2 < - 1+ i^ slots: 

- Each informed node sends m with probability i and terminates at the end of the phase. 

- Each uninformed node listens with probability ^f. 

• Request Phase - In each of 2^ 1+ ^* slots: 

o Each uninformed node sends a nack message with probability i, listens with probability e -~64e') 2 i ' 

and terminates if at most 5c In n noisy slots are heard, 
o Alice listens with probability ( , i _ e _ 4 ';/ 1 " 2 " 1+1/fc)i and terminates if at most 5c Inn nack messages or 

noisy slots are heard. 

Figure 2: Pseudocode of round i for e-BROADCAST for general k. 

Finally, we note that, in practice, all nodes may start with i = 1 (or any other agreed upon constant) and 
run until the termination condition is met. That is, there is no need to start at round i = 3 lg Inn (indeed, 
nodes may not agree on such a value). 

3 The General Case 

For general k, it is not sufficient to simply replace 1/2 by some function, say (k — l)/k), in our analysis since 
doing so results in a w.h.p. cost of 0{n^ k ~ l ^ k ) rather than the desired 0(n 1//fc ). Instead, the propagation 
of m must be extended in a non-trivial fashion by repeating the propagation phase k — 1 times. For a fixed 
round i £ O(lglnn), we use these repeated propagation phases to prove the existence of sets of nodes 
Si^ where h = 1, k — 1. The inform phase remains unchanged and results in the creation of the set S^i 

1 k — 1 

consisting of at least ^ (1 "_ 1/A ," newly informed nodes. In turn, the propagation phase utilizes Si,i to guarantee 

1 k — 2 

the creation of Si t 2 which consists of at least ^ (1 "_ 2/fc " newly informed nodes. In general, throughout step h 

, k — h 

of the propagation phase, the existing set Si t h of size at least ^ (1 "_ fa//fc " is used to create the new set S^h+i 

of size 2(i- ~(h+i)/k)i or larger- Therefore, by at least step h = k — 1, the set Si^-i contains at least ^.° fc n 
informed nodes which is of sufficient size to ensure that all remaining uninformed nodes can receive m if 
no step in creating S^h is blocked. Our pseudocode for general k is given in Figure [2] with the values for 
a = 1/k and b = 1 substituted. 

For completeness, we provide a full proof for the k = 3 case. This clarifies how the proof must change 
for general k and illustrates correctness which would be obscured by using general k. Notable changes are 
that Theorem|2]no longer suffices to prove a lower bound on the size of the sets S^h', although, we can still 
use it to obtain a useful (loose) upper bound. Our proof structure changes to handle the dependent variables 
discussed in Section |2~T1 

The two most notable changes is that Alice has to send with probability 2cln fc n/2\ This polyloga- 
rithmic increase is due to the need to propagate a O(lnn) factor through the proof such that each nodes' 
probabilities for sending and listening do not need to contain such a factor. As we will discuss later (in Sec- 
tion [371), this is critical to allowing us to tolerate 0(n) Byzantine nodes. The other change is less critical: 
we consider 13 lg Inn < i < lgn + 0(1); in general, i = fi(lglnn). 

In the following, we conceptually divide the n nodes into n l 2 °y 3 n groups each of size 2 2i / 3 / In 2 n nodes. 
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We stress that these groups provide a method of counting how many nodes become informed, but such 
groupings play no part in the protocool. Our goal is to show that at least one member of each group becomes 
informed by the end of the phase. To do this, we first prove that, for every group, each slot in the inform 
phase has a sufficient probability of being listened to by a node in the group. 

Lemma 13. Assume less than (1 — e')n nodes have terminated. Then for any slot in the inform phase, the 
probability that at least one node in each group is listening in that slot is at least 2 i/3i n ■ 

Proof. In round i, consider a group of 2 2 */ 3 / In 2 n nodes. Since at most (1 — e')n nodes have terminated, 
we can consider each such disjoint group to possess at least e'2 2i / 3 /ln 2 n active nodes. Therefore, in 
a fixed slot, the probability that none of the nodes in a group are listening is (1 - -^f' 2 2l/3 /in 2 n < 
g -2/(2 1 / 3 in 2 n) Therefore, the probability that at least one node in a group is listening is equal to or greater 
than 1 - e ~ 2 /( 2l/3 Xv? n > > 2l/3 \^ n by Lemmaffl □ 

Using our analysis via groups, the next lemma states proves the existence of a set S^i of at least n 2 ^y 3 n 
nodes informed after the completion of a non-blocked inform phase. 



Lemma 14. Assume that at most (1 — e')n nodes have terminated. Then, with high probability when 

n In 2 n 

2 2i/3 



51glnn < i < Ign + O(l), after an unblocked inform phase, there exist at least nl 2 °, 3 n newly informed 



nodes. 

Proof. The phase consists of s = 2( 4 / 3 )' slots. Since at most (1 — e')n nodes have terminated, Lemma [T3l 
guarantees that the probability no nodes in a group of size 2 2 */ 3 / In 2 n receive m in a fixed slot is at most 
l~( 2cl 2 " n ){ 2 i/3 i n a n )?j 1 where qj = if Carol jams and qj = 1 if she does not. It follows that the probability 
of all active uninformed nodes failing to obtain m in this step is at most rij=i(l ~~ ( 2c jp- n ) ( 2i/A | a - ) qj ) 

_ 2c In n n ■ 

< e 2< 4 / 3 ) i 1 3 < n~ c since J2i Qj ^ §• Taking a union bound over all groups, we conclude that at least 
one node from each of the n 2 1 2 1 */ 3 n groups becomes informed; this yields the result. □ 

While not tight, it is sufficient to use essentially the same upper bound as before (proof via Theorem [2): 

Lemma 15. Assume at least e' n nodes are uninformed at the start of an unblocked inform phase and 
51glnn < i < lgn + 0(1). Then, w.h.p., the number of nodes that become newly informed by the end 

of this inform phase is at most — — — for an arbitrarily small constant A' > and for n sufficiently 
large. 



The members of the set S^i are now used in the propagation phase to prove the existence of a larger set 5^2 

n In n 

2*/3 



of at least n l " 3 n informed members. Conceptually, this is proved by showing that members in S^i can create 



at least one informed member in each of ^.y" disjoint groups consisting of |^ nodes each; call each such 
conceptual group a 2-group. Again, we need to lower bound the probability that a slot is covered by at least 
one node in such 2-group. 

Lemma 16. Assume that at most (1 — e')n nodes have terminated and the inform phase was not blocked. 
Then, for any slot in step h = 1 of the propagation phase, the probability that at least one node in a 2-group 
is listening in that slot is at least 2 ( 2 /3^ p— • 

Proof. Let G be a 2-group consisting of 2 8 / 3 Inn nodes. Since at most (1 — e')n nodes have terminated, we 
can consider each disjoint 2-group to possess at least e' 2*/ 3 / In n active nodes. The probability that none of 
the nodes in G are listening in a slot is (1 - 2™y'-* i/3) n™ < e -2ec/(2W^ inn) Therefore) the probability 
that at least one node in G is listening to a particular slot is at least 1 — e - 2ec /( 2(2/3)l lnn ) > ec j (2( 2 / 3 ) 4 Inn) 
by Lemma [TJ □ 
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Define a blocked step of the propagation phase to be one where more than half the slots in that step are 
jammed. We can now prove the existence of S 1 ,^: 

Lemma 17. Assume that at most (1 — e')n nodes have terminated and the inform phase was not blocked. 
Then, w.h.p., at least nodes are newly informed in an unblocked step h = 1 of the propagation phase 
for 51gln?7, < i < lgn + O(l). 

Proof. The phase consists of s = 2( 4 / 3 )* slots. For a fixed slot, the probability that a single node from S^i is 
sending isp = By Lemmas[l4]andCE5l we know that < \S iA \ < (1+V 2 ffl n2w , 

o (l + A / )4n ln^ n o ■ In 9 

we have p > ^§ • (1 - I) i^ 5 > ^| e -2(i+A')4in 2 n/2V2 > in ^ range of Since at 

most (1 — e')n nodes have terminated, by Lemma[l6l the probability that no nodes in a fixed 2-group receive 

m in a single slot is at most 1 — { ^I/z )( 2(2/3)1 where = if Carol jams and gj = 1 if she does not. 

It follows that the probability of all active and uninformed nodes in the 2-group failing to obtain m in this 

c In n V^ s n 

step is at most Uj^i 1 ~ {-0m) Qj) < e ^ W < n ~ c/2 since Ei ?i > | ■ Taking a union bound 
over all n In n/2 4 / 3 groups yields the result. □ 



We need the next upper bound to ensure that members of Sip will successfully send with sufficiently high 
probability: 

Lemma 18. Assume at least e' n nodes are uninformed and the inform phase and step h = 1 of the prop- 
agation phase were not blocked. Then, w.h.p. where 51glnn < i < Ign + O(l), the number of nodes 

that become newly informed by the end of this inform phase is at most ^f/g" 1 " " for a constant X" > 
depending only on e and for n sufficiently large. 

Finally, we can show that all remaining nodes receive m if step h = 2 of the propagation phase is not 
blocked: 

Lemma 19. Assume that each of the inform phase and step h = 1 of the propagation phase in round 
71glnn < i < lgn + 0(1) were not blocked. Then, if step h = 2 of the propagation phase in round i is 
unblocked, w.h.p. all nodes are informed by the end of the propagation phase. 

Proof. Let s = 2^ 4 / 3 ^ be the number of slots. Since the inform phase and step h = 1 of the propagation 
phase were not blocked, Lemmas [171 and [T8l guarantee w.h.p. that n ^}^ < |£i,2| < ( - 1+A 2 \ 8 / C 6 nln - for some 
arbitrarily small constant A > . In a single slot, the probability that exactly one informed node in Si 2 
is sending is at least |5i, 2 |(J)(l - ^) |5 '< 2hl > §7^(1 - I)( 1 +*") 8 «* hl V2 i/8 > J™- for % > 131glnn 
and n sufficiently large. Therefore, the probability a particular uninformed node does not receive m in a 
single slot is at most 1 — ^ qj where qj = if Carol jams and qj = if she does not. The probability 
of a specific active and uninformed node failing to obtain m in this phase is at most n^=i(l — ^4/°" Qj) 

2 c In n V^s n 

C e W7W^ q i which gives us the high probability guarantee since J2i Qj ^ f • Taking a union bound 
over all nodes yields the result. □ 

Therefore, we can show that all nodes will receive m so long as neither the inform phase nor the steps of 
the propagation phase are blocked. Note that the argument in Lemma QTJ does not change so long as k is 
a constant (see below). Analogous to our argument when k = 2, When round i = lgn + lg(C '/ ' 0) is 
reached, Carol and the Byzantine nodes do not have sufficient energy to block a phase (or a step of a phase) 
in which case, the termination conditions for Alice and the correct nodes are met. By chaining together 
more proofs showing the existence of S% h, this proof structure can be extended for any constant k. 
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3.1 Limits This Approach 

By increasing k, the protocol is more resource competitive; however, there is a limit. Note that all phases 
have the same length and so the latency of the propagation phase and the overall cost to Alice and each 
increases by a factor of Q(k). Now consider if k > w(l). Then, Alice and her nodes each require uj{n l / k ) 
to execute the 0(k) propagation phase steps and this exceeds their budget. 

This cannot be remedied through any (j(l)-factor increase in the budget of each node. To see why, let 
k = 2 and assume that each node now has a budget of C n 1 / 2 In n. Note that Carol may now block phases 
of length C n 3 / 2 In n which occurs for round i = lg n + (2/3) lg In n + (2/3) lg C. However, in this round, 
each correct node must spend 2*/ 2 Inn = ^(n 1 / 2 In 4 / 3 n); this exceeds its budget. This problem manifests 
for any k = w(l). 

4 Extensions to the Protocol 

In this section, we sketch how e-BROADCAST can be modified to tolerate a reactive adversary when / < 1/4. 
We conclude by discussing how exact knowledge of In n and n is not required to successfully execute e- 
Broadcast. 

4.1 Reactive Jamming: Make Your Own Noise 

Within the current time slot, a reactive adversary can detect channel activity and decide whether to jam. 
The ability to perform CCA makes it possible for Carol to detect such activity based on the received signal 
strength indicator (RSSI) which incurs negligible cost. During either the inform or propagation phases, 
Carol is guaranteed to interfere with the transmission of m if she jams. Such targeted jamming invalidates 
our analysis in Lemmas [2l [3l and [4] Critically, while RSSI enables Carol to detect channel activity, it 
provides no information about the transmitted content. Therefore, reactive jamming is only effective if 
the bulk of the channel activity involves the transmission of m. For example, if half of the slots contain 
non-critical traffic and the other half contain m, then jamming based simply on RSSI is no better than 
randomly jamming. Of course, Carol might activate her transceiver in order to listen to a small portion of a 
transmission before deciding to jam; however, this is expensive. 

The non-critical traffic is assumed to result from other devices in the network executing tasks that the 
adversary has no interest in disrupting, in contrast to m which is assumed to be a critical transmission. As 
in ||23l , if there is sufficient background network traffic such that a constant fraction of the slots in each 
round are in use, then a reactive adversary can be tolerated. But what if such traffic is absent? 

We show that, for / < 1/4, a reactive Carol is unable to prevent communication indefinitely and our 
algorithm is still resource competitive. Although / < 1/4 implies that the aggregate energy possessed by 
Alice and the correct nodes exceeds that of Carol and her Byzantine nodes, we emphasize that this problem 
is still non-trivial. For example, it is not possible to have have Alice outspend Carol since Alice can only 
send the message 0{n 1 / 2 ) times while Carol can jam for 0(n 3 / 2 ) slots. As described above, we need to 
have the uninformed nodes generate additional traffic in order to overcome a reactive jammer. 

To do this, for the inform and propagation phases, the modified protocol specifies that each node sends 
a decoy message with probability -^-^ per slot and we assume that each correct node listens with a constant 
factor increase in probability (see p u in the proof of Lemma [2]). We now re-prove Lemma [2] 

Lemma |2j Assume at least e' n nodes are uninformed at the start of an unblocked inform phase and 
31glnn < i < Ign + O(l). Then, w.h.p., the number of correct nodes that become newly informed by 
the end of this inform phase is at least ^ 1 ~^ / " lnn /or an arbitrarily small constant A > and for n suffi- 
ciently large. 
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Proof. Let s = 2^ 3 / 2 ^. Let the random variable Zj = 1 if a slot is occupied by one or more decoy 
messages; otherwise, let Zj = 0. Since all correct nodes send a decoy message independently with uniform 
probability Pr(Zj = 1) = 1 - (1 - ^) e ' n > 1 - e~ 3 / 4 > 1/2. Letting Z = ^ Zj it follows that 
E[Z] > (l/2)s. Conversely, using LemmaCQ Pr(Zj = 1) < 1 — (1 — < 1 - e - 3 /( 2e ') ; therefore, 

E\Z\ < (1 — e _3 /^ 2e )) s. By standard Chernoff bounds, for i > 31glnn, the number of slots containing 
one or more decoy messages, denoted by sn, is (1 — <5)(l/2)s < sn < (1 + 5)(1 — e~ 3 ^ 2t '^)s w.h.p. for 
5 > arbitrarily small depending only on sufficiently large n. By a similar argument, given i > 3 lg In n, 
the number of slots in which Alice sends m is sa = (1 ± 5')2 a * Inn w.h.p. for 5' > arbitrarily small 
depending only on sufficiently large n. 

We redefine an inform phase as blocked if Carol jams more than s/4 slots containing m or at least one 
decoy message. Carol's choice to jam such a slot (or listen to it) is made without knowing whether the slot 
contains mora decoy message. Therefore, for a fixed slot containing m sent by Alice, the probability that 
Carol fails to listen to or block this slot in a non-blocked phase is at least 1 — -g—. The probability that 

this same slot is not used by a correct node for sending a decoy message is at least e _3 '( 2e ' as determined 
above. Let p u denote the probability that a node u listens to a particular slot. Therefore, assuming Alice 
sends m, the probability that u receives m in a fixed slot is at least (1 — ^■)(e~ 3 ^ 2e '^)p u > (e~ 3 /( 2lE ') — 

4. e 3/(2^).(i ( -/)('i/2)2(3/a)* ) p " = (^rk 7 ) - 2§7&K for small enough S given sufficiently large n. It follows 
that, for sufficiently small <5"(say 5" < 1/2), the probability that u receives m in a slot is at least ( 3/ } 2e i) — 
(i+f ) \„ - Pu 

2ei/{2e'))Pu 4e 3/(2e')- 

As in our original proof, let X u = 1 if u obtains m in the inform phase; otherwise, let X u = 0. 
Then Pr(X u = 1) > 1 - (1 - A Jj J i2t i ) Y A - 0(l/n c ') where the last term is the probability that s N or 
sa deviate by more than S from their respective expected values and d > is some constant. Redefine 
p u = ^ilyw ; this is a constant factor increase, so the cost to each node is asymptotically equal. Then, 

Pr{X u = 1) > 1 - (1 - e , {1 * 6 , )2 i ) {1 - S ' )2i/2lnn ~ 0{l/n c ') > 1 - e -8inn/( e '2^) _ {l/n d ') > 

2 ^°y" — 0(l/n c ") > -p7£j2 f° r sufficiently lai - ge n. We can then apply Theorem [2] as in the original proof 
and obtain the desired result. □ 

The proofs for Lemmas [3] and [4] can be redone in a similar fashion. Now we show that communication 
occurs in the final round. The modifications to the sending and listening probabilities, and sending of the 
decoy messages, increases costs by a constant factor. 

Lemma 20. With high probability, the modified version o/e-BROADCAST guarantees that at least (1 — e')n 
nodes become informed when f < 1 /24 and Carol is reactive. 

Proof. Again, call a slot active if it contains either m or noise. Using the new definition of a blocked phase 
defined in the proof of Lemma |2] above, note that Carol and her Byzantine nodes cannot block a phase 
containing at least 4C/n 3 / 2 active slots. We can make the same argument as in[T2]by using f3 rather than 
1/4 as the fraction of jammed slots that constitute a blocked phase; however, for simplicity we stick with 
1/4 noting that this does not affect correctness. From the proof above, w.h.p., at least (1 — 5)(l/2)2^ 3 / 2 ^ 
slots in a phase are active. For concreteness, set 5 = 1/2 which implies that, w.h.p, at least (1/4) 2( 3 / 2 ) 1 
slots are active. Then, solving for i in 2^ 3//2 ^/4 = 4(7/ n 3 / 2 tells us that, w.h.p, Carol and her Byzantine 
nodes cannot block round i = |lg(16C/) + lgn. By our new Lemma [2 and by modifying Lemmas [3] 
and|U at least (1 — e')n correct nodes will become informed in this round. 

As shown in Lemma [T2l we must ensure that Alice and the correct nodes do not exceed their respective 
budgets. When executing e-BROADCAST, there exists some constant d! > such that the cost to each 
node in round i is at most d' 2*/ 2 . The cost to a correct node u is at most d'2 % / 2 + (J- + p u ) 2( 3 / 2 ^ 

where p u = ^rfzgr^ an d we can set 5' = 1/2. Substituting for i, the cost to u for this round is at most 
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C u = {d'ilQCf) 1 ^ + 12 Cf + d" (C ff/^n 1 / 2 where d" > is some constant depending only on e. 
Because rounds double in size, the total cost to u up to and including this round is at most 2 C u . Solving for 

C in Cn 1 / 2 >2C U yields C > ^tfg^ . Therefore, for / < 1/24 and sufficiently large C, the 
correct nodes do not exceed their budget. □ 

We note that / < 1/24 is an artifact of the constants used to define a blocked phase and to provide the 
w.h.p. guarantees; it seems likely that this can be improved. However, the crucial point is that our modified 
e-BROADCAST is resource competitive against a reactive Carol who controls ©(n) Byzantine nodes, and 
correct nodes can bear the costs for tolerating such a reactive adversary; we do not rely on an external and 
free source of noise. 

4.2 System-Size Parameters 

As stated, the sending and listening probabilities in our protocol require knowledge of In n and 1/n. How- 
ever, the guarantees provided by e-BROADCAST still hold if each node has a constant-factor approxima- 
tion to these values. Such approximations can be used instead of the true values while incurring only a 
constant-factor increase in cost. There are well-known "folklore" algorithms for efficiently obtaining such 
approximations in a distributed setting and we may hope that these are executed prior to a jamming attack. 

If such approximations are not possible, our protocol still functions if all nodes share the same polyno- 
mial overestimate of n; that is, v u = n c for any constant d > 1. Each node obtains the constant-factor 
approximation £ u = [clnn] to use in our protocol. In the propagation phase of a fixed round i, each step 
(see Figure |2]) is executed g times with informed nodes sending with probability ^r^- where g = 1, i u . 
At some point, g = In n and, therefore, each informed node will complete that step of the phase with the 
correct sending probability to within a factor of 2. The same technique can be used in the request phase. 
In this case, the cost of executing e-BROADCAST increases by a logarithmic factor and, consequently, the 
guarantees hold so long as there exists a large, but sublinear, 0(j^-) number of Byzantine nodes. 

5 Conclusion and Future Work 

As the size of WSN devices decrease, communication protocols must satisfy the strict energy constraints that 
are unavoidable at this scale while remaining robust to adversarial attacks. Our results address this challenge 
by demonstrating the feasibility of a critical communication primitive in the face of a powerful adversary 
who controls ©(n) devices in a dense WSN. Moreover, the correct devices enjoy a significant advantage 
in terms of energy expenditure. A critical open question is whether these resource-competitive results have 
an analogue in multi-hop WSNs. It would also be of interest to examine other fundamental distributed 
communication problems, such as consensus or leader election, from a resource-competitive perspective. 

Acknowledgements: We thank Jared Saia and Valerie King for their helpful comments and suggestions. 
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